Vulnerability in Kernel package: scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
Summary
GSD-2021-1000151: scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand(). Affects Kernel versions >= af2a0c51b1205327f55a7e82e530403ae1d42cbb, < 702cdaa2c6283c135ef16d52e0e4e3c1005aa538. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides an interface between the hardware and software layers, allowing applications to communicate with the underlying hardware. The scsi subsystem within the Kernel package handles storage devices and their associated protocols. One of the drivers in this subsystem is qla2xxx, which supports QLogic Fibre Channel Host Bus Adapters (HBAs). These HBAs enable communication between servers and storage devices over Fibre Channel networks.
Vulnerability Detail
The vulnerability identified in the qla2xxx driver is a crash that occurs in the qla2xxx_mqueuecommand() function. This vulnerability was introduced in version v5.5 of the Linux Kernel by commit af2a0c51b1205327f55a7e82e530403ae1d42cbb. It was fixed in version v5.10.36 by commit 702cdaa2c6283c135ef16d52e0e4e3c1005aa538. The crash can be triggered by a specific sequence of commands sent to the qla2xxx driver, potentially leading to a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by updating the Kernel package.
Conclusion
In conclusion, the Kernel package's qla2xxx driver is vulnerable to a crash in the qla2xxx_mqueuecommand() function. This vulnerability can potentially lead to a denial-of-service (DoS) condition. It is recommended to update the Kernel package to version v5.10.36 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is currently unknown. It may lead to a denial-of-service (DoS) condition, but further analysis is required to determine the full extent of the impact.
The remote exploitability of this vulnerability has not been established yet. It depends on various factors, including the network configuration and the presence of any mitigating security measures.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
This vulnerability affects systems running the Linux operating system with the qla2xxx driver enabled. It may be of particular concern to organizations using QLogic Fibre Channel HBAs for storage connectivity.
For more details about this vulnerability, including the specific code changes that fix it, you can refer to the source link provided in the database_specific section of this report (https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000151.json).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
